CVE-2026-109439

Summary

A missing authentication vulnerability in Lantronix XPress-DR and XPress-DR-I devices allows remote attackers to read and modify critical device configuration without any authentication. This affects devices running firmware through version 8.1.0.0 and is particularly concerning because these devices are now end-of-life, meaning no further security updates are available.

Exploitability

Exploitation is straightforward with no prerequisites - attackers can send crafted UDP frames to port 30718 without authentication to read configuration data or overwrite IP address and serial-channel forwarding records that persist across reboots.

Blast radius

The vulnerability could affect a wide range of industrial devices that rely on these legacy routers, potentially allowing attackers to redirect network traffic, gain persistent access points, and compromise entire network segments that depend on these devices for connectivity.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Immediate remediation is to upgrade all affected XPress-DR and XPress-DR-I devices to firmware version 8.1.0.1 or later, as this specific version contains the authentication fix for the vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.